Docker容器化部署完全指南：从入门到生产环境#
Docker已经成为现代应用部署的标准工具，它通过容器化技术简化了应用的部署、扩展和管理。本文将全面介绍Docker的使用方法，从基础概念到生产环境的最佳实践。
Docker基础概念#
1. 核心概念理解#
Docker架构：
1
2
3
4
5
6
7
| # Docker包含三个核心概念：
# 1. 镜像（Image）：应用的静态模板
# 2. 容器（Container）：镜像的运行实例
# 3. 仓库（Repository）：镜像的存储中心
# Docker Daemon和Docker Client通信流程：
Client --REST API--> Docker Daemon --containerd--> runc (container runtime)
|
基本命令：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| # 镜像操作
docker images # 查看本地镜像
docker pull nginx:latest # 拉取镜像
docker build -t myapp:v1 . # 构建镜像
docker rmi nginx:latest # 删除镜像
# 容器操作
docker run -d nginx # 运行容器
docker ps # 查看运行中的容器
docker ps -a # 查看所有容器
docker stop container_id # 停止容器
docker rm container_id # 删除容器
docker logs container_id # 查看容器日志
docker exec -it container_id bash # 进入容器
|
2. Dockerfile详解#
基础Dockerfile示例：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
| # 多阶段构建示例
FROM node:18-alpine AS builder
# 设置工作目录
WORKDIR /app
# 复制依赖文件
COPY package*.json ./
# 安装依赖
RUN npm ci --only=production
# 复制源代码
COPY . .
# 构建应用
RUN npm run build
# 生产阶段
FROM nginx:alpine
# 复制构建结果
COPY --from=builder /app/dist /usr/share/nginx/html
# 复制配置文件
COPY nginx.conf /etc/nginx/nginx.conf
# 暴露端口
EXPOSE 80
# 启动命令
CMD ["nginx", "-g", "daemon off;"]
|
Dockerfile最佳实践：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
| # 使用具体版本标签，避免latest
FROM node:18.17.0-alpine
# 创建非root用户
RUN addgroup -g 1001 -S nodejs && \
adduser -S nextjs -u 1001
# 设置工作目录
WORKDIR /app
# 按顺序复制，利用缓存层
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
# 复制应用代码
COPY --chown=nextjs:nodejs . .
# 切换到非root用户
USER nextjs
# 健康检查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
CMD curl -f http://localhost:3000 || exit 1
# 设置标签
LABEL maintainer="your-email@example.com" \
version="1.0.0" \
description="My Node.js application"
|
镜像优化技巧#
1. 多阶段构建#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| # 构建阶段
FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# 生产阶段
FROM node:18-alpine AS production
WORKDIR /app
# 只复制生产依赖
COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force
# 复制构建结果
COPY --from=builder --chown=node:node /app/dist ./dist
# 创建用户
RUN addgroup -g 1001 -S nodejs && \
adduser -S nodejs -u 1001
USER nodejs
EXPOSE 3000
CMD ["node", "dist/index.js"]
|
2. 镜像大小优化#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| # 使用更小的基础镜像
FROM alpine:3.18
FROM node:18-alpine # 而不是 node:18
# 合并RUN指令
RUN apk add --no-cache git curl && \
npm install -g nodemon && \
npm cache clean --force
# 使用.dockerignore
# .dockerignore文件
node_modules
npm-debug.log
.git
.gitignore
README.md
.env
.nyc_output
coverage
.vscode
# 清理包管理器缓存
RUN apt-get update && \
apt-get install -y python3 && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
# 使用多阶段构建去除构建依赖
COPY --from=builder /app/node_modules ./node_modules
|
3. 安全加固#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
| # 使用非root用户
FROM node:18-alpine
RUN addgroup -g 1001 -S appuser && \
adduser -S appuser -u 1001
USER appuser
# 最小权限原则
RUN apk add --no-cache dumb-init
USER appuser
ENTRYPOINT ["dumb-init", "--"]
# 安全扫描
FROM node:18-alpine
RUN apk add --no-cache dumb-init && \
adduser -D -s /bin/sh appuser
# 使用特定版本标签，避免安全漏洞
FROM node:18.17.0-alpine@sha256:abc123...
|
Docker Compose应用#
1. 基础配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
| # docker-compose.yml
version: '3.8'
services:
# Web应用服务
web:
build:
context: .
dockerfile: Dockerfile
ports:
- "3000:3000"
environment:
- NODE_ENV=production
- DATABASE_URL=postgresql://user:password@db:5432/myapp
depends_on:
- db
- redis
volumes:
- ./logs:/app/logs
restart: unless-stopped
networks:
- app-network
# 数据库服务
db:
image: postgres:15-alpine
environment:
POSTGRES_DB: myapp
POSTGRES_USER: user
POSTGRES_PASSWORD: password
volumes:
- postgres_data:/var/lib/postgresql/data
- ./init.sql:/docker-entrypoint-initdb.d/init.sql
restart: unless-stopped
networks:
- app-network
# Redis缓存
redis:
image: redis:7-alpine
command: redis-server --appendonly yes
volumes:
- redis_data:/data
restart: unless-stopped
networks:
- app-network
# Nginx反向代理
nginx:
image: nginx:alpine
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf
- ./ssl:/etc/nginx/ssl
depends_on:
- web
restart: unless-stopped
networks:
- app-network
volumes:
postgres_data:
redis_data:
networks:
app-network:
driver: bridge
|
2. 开发环境配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| # docker-compose.dev.yml
version: '3.8'
services:
web:
build:
context: .
dockerfile: Dockerfile.dev
volumes:
- .:/app
- /app/node_modules
environment:
- NODE_ENV=development
- CHOKIDAR_USEPOLLING=true
ports:
- "3000:3000"
- "9229:9229" # Debug port
command: npm run dev
# 热重载支持
webpack:
build:
context: .
dockerfile: Dockerfile.webpack
volumes:
- .:/app
- /app/node_modules
command: npm run watch
# 测试数据库
db-test:
image: postgres:15-alpine
environment:
POSTGRES_DB: myapp_test
POSTGRES_USER: test_user
POSTGRES_PASSWORD: test_password
ports:
- "5433:5432"
|
3. 生产环境配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
| # docker-compose.prod.yml
version: '3.8'
services:
web:
image: myapp:latest
environment:
- NODE_ENV=production
deploy:
replicas: 3
resources:
limits:
cpus: '0.5'
memory: 512M
reservations:
cpus: '0.25'
memory: 256M
restart_policy:
condition: on-failure
delay: 5s
max_attempts: 3
nginx:
image: nginx:alpine
volumes:
- ./nginx.prod.conf:/etc/nginx/nginx.conf
- ./ssl:/etc/nginx/ssl
ports:
- "80:80"
- "443:443"
|
容器编排与Kubernetes#
1. Kubernetes基础配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
| # deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp-deployment
labels:
app: myapp
spec:
replicas: 3
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: myapp:v1.0.0
ports:
- containerPort: 3000
env:
- name: NODE_ENV
value: "production"
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: myapp-secrets
key: database-url
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"
livenessProbe:
httpGet:
path: /health
port: 3000
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /ready
port: 3000
initialDelaySeconds: 5
periodSeconds: 5
|
2. 服务发现和负载均衡#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
| # service.yaml
apiVersion: v1
kind: Service
metadata:
name: myapp-service
spec:
selector:
app: myapp
ports:
- protocol: TCP
port: 80
targetPort: 3000
type: ClusterIP
---
# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: myapp-ingress
annotations:
kubernetes.io/ingress.class: nginx
cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
tls:
- hosts:
- myapp.example.com
secretName: myapp-tls
rules:
- host: myapp.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: myapp-service
port:
number: 80
|
3. 配置管理和密钥#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| # configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: myapp-config
data:
NODE_ENV: "production"
LOG_LEVEL: "info"
REDIS_HOST: "redis-service"
REDIS_PORT: "6379"
---
# secret.yaml
apiVersion: v1
kind: Secret
metadata:
name: myapp-secrets
type: Opaque
data:
database-url: <base64-encoded-url>
jwt-secret: <base64-encoded-secret>
api-key: <base64-encoded-key>
|
监控和日志管理#
1. 容器监控#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
| # docker-compose.monitoring.yml
version: '3.8'
services:
# Prometheus监控
prometheus:
image: prom/prometheus
ports:
- "9090:9090"
volumes:
- ./prometheus.yml:/etc/prometheus/prometheus.yml
- prometheus_data:/prometheus
command:
- '--config.file=/etc/prometheus/prometheus.yml'
- '--storage.tsdb.path=/prometheus'
- '--web.console.libraries=/etc/prometheus/console_libraries'
- '--web.console.templates=/etc/prometheus/consoles'
# Grafana可视化
grafana:
image: grafana/grafana
ports:
- "3001:3000"
environment:
- GF_SECURITY_ADMIN_PASSWORD=admin
volumes:
- grafana_data:/var/lib/grafana
- ./grafana/dashboards:/etc/grafana/provisioning/dashboards
# 节点导出器
node-exporter:
image: prom/node-exporter
ports:
- "9100:9100"
volumes:
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
command:
- '--path.procfs=/host/proc'
- '--path.rootfs=/rootfs'
- '--path.sysfs=/host/sys'
- '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
# cAdvisor容器监控
cadvisor:
image: gcr.io/cadvisor/cadvisor
ports:
- "8080:8080"
volumes:
- /:/rootfs:ro
- /var/run:/var/run:rw
- /sys:/sys:ro
- /var/lib/docker/:/var/lib/docker:ro
privileged: true
volumes:
prometheus_data:
grafana_data:
|
2. 应用监控集成#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| // Node.js应用监控
const prometheus = require('prom-client')
// 创建指标
const httpRequestDuration = new prometheus.Histogram({
name: 'http_request_duration_seconds',
help: 'Duration of HTTP requests in seconds',
labelNames: ['method', 'route', 'status_code']
})
const httpRequestTotal = new prometheus.Counter({
name: 'http_requests_total',
help: 'Total number of HTTP requests',
labelNames: ['method', 'route', 'status_code']
})
// Express中间件
const metricsMiddleware = (req, res, next) => {
const start = Date.now()
res.on('finish', () => {
const duration = (Date.now() - start) / 1000
const labels = {
method: req.method,
route: req.route?.path || req.path,
status_code: res.statusCode
}
httpRequestDuration.observe(labels, duration)
httpRequestTotal.inc(labels)
})
next()
}
// 监控端点
app.get('/metrics', async (req, res) => {
res.set('Content-Type', prometheus.register.contentType)
res.end(await prometheus.register.metrics())
})
|
3. 集中化日志管理#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
| # docker-compose.logging.yml
version: '3.8'
services:
# Elasticsearch
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch:8.5.0
environment:
- discovery.type=single-node
- "ES_JAVA_OPTS=-Xms512m -Xmx512m"
volumes:
- elasticsearch_data:/usr/share/elasticsearch/data
ports:
- "9200:9200"
# Logstash
logstash:
image: docker.elastic.co/logstash/logstash:8.5.0
volumes:
- ./logstash.conf:/usr/share/logstash/pipeline/logstash.conf
ports:
- "5044:5044"
depends_on:
- elasticsearch
# Kibana
kibana:
image: docker.elastic.co/kibana/kibana:8.5.0
ports:
- "5601:5601"
environment:
ELASTICSEARCH_HOSTS: http://elasticsearch:9200
depends_on:
- elasticsearch
# Filebeat
filebeat:
image: docker.elastic.co/beats/filebeat:8.5.0
user: root
volumes:
- ./filebeat.yml:/usr/share/filebeat/filebeat.yml
- /var/lib/docker/containers:/var/lib/docker/containers:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
depends_on:
- logstash
volumes:
elasticsearch_data:
|
CI/CD集成#
1. GitHub Actions配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
| # .github/workflows/docker.yml
name: Docker CI/CD
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Test
run: |
docker-compose -f docker-compose.test.yml up --abort-on-container-exit
docker-compose -f docker-compose.test.yml down
build:
needs: test
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Login to Docker Hub
uses: docker/login-action@v2
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Extract metadata
id: meta
uses: docker/metadata-action@v4
with:
images: myorg/myapp
tags: |
type=ref,event=branch
type=ref,event=pr
type=sha,prefix={{branch}}-
- name: Build and push
uses: docker/build-push-action@v4
with:
context: .
file: ./Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
deploy:
needs: build
runs-on: ubuntu-latest
if: github.ref == 'refs/heads/main'
steps:
- name: Deploy to production
uses: appleboy/ssh-action@v0.1.5
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.SSH_KEY }}
script: |
cd /opt/myapp
docker-compose pull
docker-compose up -d
docker system prune -f
|
2. GitLab CI配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
| # .gitlab-ci.yml
stages:
- test
- build
- deploy
variables:
DOCKER_REGISTRY: registry.gitlab.com
IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
test:
stage: test
script:
- docker-compose -f docker-compose.test.yml up --abort-on-container-exit
- docker-compose -f docker-compose.test.yml down
build:
stage: build
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build -t $IMAGE_NAME .
- docker push $IMAGE_NAME
only:
- main
- develop
deploy_staging:
stage: deploy
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker-compose -f docker-compose.staging.yml pull
- docker-compose -f docker-compose.staging.yml up -d
environment:
name: staging
only:
- develop
deploy_production:
stage: deploy
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker-compose -f docker-compose.prod.yml pull
- docker-compose -f docker-compose.prod.yml up -d
environment:
name: production
only:
- main
when: manual
|
安全最佳实践#
1. 容器安全扫描#
1
2
3
4
5
6
7
8
9
| # 使用Trivy扫描镜像漏洞
trivy image myapp:latest
# 集成到CI/CD中
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
aquasec/trivy image --exit-code 0 --severity HIGH,CRITICAL myapp:latest
# Docker Scout（Docker Hub）
docker scout cves myapp:latest
|
2. 安全配置#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
| # docker-compose.security.yml
version: '3.8'
services:
web:
image: myapp:latest
security_opt:
- no-new-privileges:true
read_only: true
tmpfs:
- /tmp
- /var/cache
user: "1001:1001"
cap_drop:
- ALL
cap_add:
- CHOWN
- SETGID
- SETUID
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
|
3. 网络安全#
1
2
3
4
5
6
7
8
9
| # 创建自定义网络
docker network create --driver bridge --subnet=192.168.0.0/24 app-network
# 限制容器通信
docker run --network=app-network --ip=192.168.0.10 myapp
# 防火墙规则
iptables -A INPUT -p tcp --dport 2376 -j DROP
iptables -A INPUT -s 192.168.0.0/24 -p tcp --dport 2376 -j ACCEPT
|
性能优化#
1. 构建性能优化#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
| # 使用BuildKit优化构建
# .docker/config.json
{
"experimental": "enabled",
"features": {
"buildkit": true
}
}
# 使用缓存挂载
FROM node:18-alpine
RUN --mount=type=cache,target=/root/.npm \
npm ci --only=production
# 并行构建
FROM node:18-alpine AS deps
COPY package*.json ./
RUN npm ci
FROM node:18-alpine AS builder
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
FROM node:18-alpine AS runtime
COPY --from=builder /app/dist ./dist
COPY --from=deps /app/node_modules ./node_modules
|
2. 运行时性能优化#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
| # docker-compose.optimized.yml
version: '3.8'
services:
web:
image: myapp:latest
deploy:
resources:
limits:
cpus: '1.0'
memory: 1G
reservations:
cpus: '0.5'
memory: 512M
ulimits:
nofile:
soft: 65536
hard: 65536
sysctls:
- net.core.somaxconn=65535
healthcheck:
test: ["CMD", "node", "healthcheck.js"]
interval: 30s
timeout: 10s
retries: 3
start_period: 40s
|
故障排除指南#
1. 常见问题解决#
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| # 容器无法启动
docker logs container_id # 查看日志
docker inspect container_id # 检查配置
docker exec -it container_id bash # 进入容器调试
# 内存问题
docker stats # 查看资源使用
docker system df # 查看磁盘使用
docker system prune -a # 清理无用资源
# 网络问题
docker network ls # 查看网络
docker network inspect network_id # 检查网络配置
docker exec container_id ping service_name # 测试连通性
|
2. 性能调试#
1
2
3
4
5
6
7
8
9
10
11
| # 容器性能分析
docker run --rm --pid=host \
--cap-add=SYS_PTRACE \
--security-opt=apparmor:unconfined \
nicolaka/netshoot \
ss -tuln # 查看网络连接
docker run --rm --pid=host \
--cap-add=SYS_PTRACE \
brendangregg/flamegraph:latest \
perf record -p $(pgrep node) -g -- sleep 30
|
Docker容器化部署提供了强大的应用隔离和部署能力。通过掌握本文介绍的技术，你可以：
- 构建优化的Docker镜像：多阶段构建、安全加固、大小优化
- 管理复杂应用：Docker Compose、Kubernetes编排
- 实现监控告警：Prometheus、Grafana、ELK Stack
- 自动化部署：CI/CD流水线集成
- 保障系统安全：镜像扫描、运行时安全、网络安全
- 优化性能：构建优化、资源限制、性能调优
记住，容器化不仅仅是打包应用，更是构建现代化、可扩展应用架构的基础。持续学习和实践这些技术，将帮助你构建更加健壮和高效的应用系统。